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Abstract 

It is well-known that Shor's factorization algorithm, Simon's period-finding 
algorithm, and Deutsch's original XOR algorithm can all be formulated as solu- 
tions to a hidden subgroup problem. Here the salient features of the information- 
processing in the three algorithms are presented from a different perspective, in 
terms of the way in which the algorithms exploit the non-Boolean quantum logic 
represented by the projective geometry of Hilbert space. From this quantum log- 
ical perspective, the XOR algorithm appears directly as a special case of Simon's 
algorithm, and all three algorithms can be seen as exploiting the non-Boolean logic 
represented by the subspace structure of Hilbert space in a similar way. Essentially, 
a global property of a function (such as a period, or a disjunctive property) is en- 
coded as a subspace in Hilbert space representing a quantum proposition, which 
can then be efficiently distinguished from alternative propositions, corresponding 
to alternative global properties, by a measurement (or sequence of measurements) 
that identifies the target proposition as the proposition represented by the subspace 
containing the final state produced by the algorithm. 



PACS numbers: 03.65.Ta 



1 Introduction 

Ideally, quantum algorithms allow the computation of certain functions more efficiently 
than any classical Turing machine. Simon's period-finding algorithm II 3111 41 achieves 
an exponential speed-up over any classical algorithm, and Shor's factorization algo- 
rithm II 1111 21 achieves an exponential speed-up over any known classical algorithm. 1 

*jbub@umd.edu 

'A complete proof of efficiency for Shor's algorithm in the general case was first provided by Ekert 
and Jozsa |7|. The algorithm involves a quantum Fourier transform, and the original formulation requires 
a degree of precision in the implementation of the Fourier transform that is exponential in the size of the 
input. Barenco et al Q showed that an approximate quantum Fourier transform, which does not compromise 
efficiency, suffices. 



1 



By contrast, Deutsch's original XOR algorithm 1 5 1 — the first quantum algorithm 
with a demonstrated speed-up over over any classical algorithm performing the same 
computational task — has an even probability of failing, so the improvement in effi- 
ciency is only achieved if the algorithm succeeds. Although a subsequent variation 
by Cleve avoids this feature, the speed-up is rather modest: one run of the quan- 
tum algorithm versus two runs of a classical algorithm. For Deutsch's problem — a 
generalization of the XOR problem — the Deutsch-Jozsa algorithm 1 4 1 achieves a more 
impressive speed-up: one run of the algorithm versus 2 n ~ 1 + 1 runs of a classical 
deterministic algorithm (for an input of n-bit strings). But even here, a probabilistic 
classical algorithm yields a solution with high probability after a few runs (see 1 10 1). 

It is well-known that these algorithms can be formulated as solutions to a hidden 
subgroup problem (see 0|9|). Here the salient features of the information-processing 
in Shor's factorization algorithm, Simon's period-finding algorithm, and Deutsch's 
original XOR algorithm are presented from a different perspective, in terms of the 
way in which the algorithms exploit the non-Boolean logic represented by the projec- 
tive geometry (the subspace structure) of Hilbert space. Essentially, a global property 
of a function (such as a period, or a disjunctive property) is encoded as a subspace in 
Hilbert space representing a quantum proposition, which can then be efficiently distin- 
guished from alternative propositions, corresponding to alternative global properties, 
by a measurement (or sequence of measurements) that identifies the target proposition 
as the proposition represented by the subspace containing the final state produced by 
the algorithm. 

Simon's algorithm and Shor's algorithm are algorithms for finding the period of a 
function. A particular period partitions the domain of the function — the input values 
for the algorithm — into mutually exclusive and collectively exhaustive subsets. Distin- 
guishing the period from alternative possible periods amounts to distinguishing the cor- 
responding partition from alternative possible partitions. A classical algorithm requires 
the evaluation of the function for a subset of input values to determine the partition — a 
computational task that involves an exponentially increasing number of steps as the 
size of the input increases. The trick in Simon's quantum algorithm, as we will see 
below, is to represent the alternative possible partitions by Hilbert space subspaces that 
are orthogonal except for overlaps or intersections. Each subspace is spanned by states 
of the input register representing the different subsets in the associated partition. A 
measurement in the computational basis can provide sufficient information to identify 
the subspace containing the state (after a suitable transformation) and hence the parti- 
tion associated with the period without evaluating the function at all (in the sense of 
producing a value in the range of the function for a value in its domain). The algorithm 
generally has to be run several times because the measurement might be inconclusive, 
corresponding to an outcome associated with the overlap region, but achieves success 
in a number of steps that is a polynomial function of the size of the input. In Shor's 
algorithm, the alternative possible partitions are associated with a family of nested sub- 
spaces. The algorithm works as a randomized algorithm by providing a candidate value 
for the period in polynomial time, which can be tested in polynomial time. 

At first sight, Deutsch's XOR problem is quite different. It involves the determi- 
nation of a disjunctive property of a Boolean function. But note that determining the 
period of a function also amounts to determining a disjunctive property of the func- 
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tion: the disjunction over the different subsets of a particular partition of the domain 
of the function, as opposed to alternative such disjunctions. As we will see below, 
Deutsch's XOR algorithm works by associating the alternative disjunctions with two 
Hilbert space planes that are orthogonal except for an intersection in a ray. From this 
perspective, the XOR algorithm appears directly as a special case of Simon's algorithm, 
and all three algorithms can be seen as exploiting the non-Boolean logic represented 
by the projective geometry of Hilbert space in a similar way. 



2 Deutsch's XOR Algorithm 

In Deutsch's XOR problem |5|, a 'black box' or oracle computes a Boolean function 
/ : B — ► B, where B = {0, 1} is a Boolean algebra (or the additive group of integers 
mod 2). The problem is to determine whether the function is 'constant' (takes the 
same value for both inputs) or 'balanced' (takes a different value for each input). The 
properties 'constant' and 'balanced' are two alternative disjunctive properties of the 
function / (for 'constant,' 0^0 and 1 — * or — * 1 and 1 — * 1; for 'balanced,' 
0^0 and 1 — * 1 or — > 1 and 1 — > 0). Classically, a solution requires two queries to 
the oracle, for the input values and 1, and a comparison of the outputs. 

Deutsch's algorithm begins by initializing 1-qubit input and output registers to the 
state |0) |0) in a standard basis (the computational basis). A Hadamard transformation — 
|0) ~~ * + |1))> |1) ~~ * (|0) — — i s applied to the input register (yielding a linear 
superposition of states corresponding to the two possible input values and 1) followed 
by a unitary transformation Ut : \x)\y) — > \x) \y © f(%)) applied to both registers that 
implements the Boolean function /: 

|o)|o) 5 -L(| ) + |i))|o) (i) 

U 4 -L(|o)|/(0)> + |l)|/(l)>) (2) 

The final composite state of both registers is then one of two orthogonal states, 
either (constant): 

= ^(10)10) + |1>|0» (3) 

\c 2 ) = -^(|0)|1> + |1>|1» (4) 

or (balanced): 

\h) = -^(|0)|0> + |1>|1» (5) 

M = ^=(|0)|1) + |1>|0» (6) 

The states |ci), |ca) and 1 62} span two planes P c , Pb in TL 2 ® Tt 2 , represented 
by the projection operators: 

Pc = P\ Cl) +P\c 2 ) (7) 
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Pb = P\ bl) +P\b 2 ) (8) 

Although the states |ci), \ c2) are not orthogonal to the states |&i), |6 2 ), the planes — 
which represent quantum disjunctions 2 — are orthogonal, except for an intersection, so 
their projection operators commute. The intersection is the line (ray) spanned by the 
vector: 

|(|00) + |01) + |10) + |11)) = -J=(|d) + lea)) = -^(|6i) + \b 2 )) (9) 

In the 'prime' basis spanned by the states |0') = H\0), |1') = H\l), the intersection 
is the state |0') |0'), the constant plane is spanned by: 



|0')|0') (10) 

1 

71 



0')|1'> = - |c 2 )) (ID 



and the balanced plane is spanned by: 

|0')|0') (12) 
|1')|1'> = -±=(\h)-\b 2 )) (13) 



V / 2 V 



i.e., 



Pc — -Pjo')|o'> + -F|0'>|i') (I 4 ) 

Pb = P\0')\0') + P\l')\l') (15) 

To decide whether the function / is constant or balanced we could measure the 
observable with eigenstates |0'0'), |0T), |1'0'), |1T) on the final state, which is in 
the 3-dimensional subspace orthogonal to the vector | l'O'), either in the constant plane 
or the balanced plane. If the state is in the constant plane, we will either obtain the 
outcome 0'0' with probability 1/2 (since the final state is at an angle 7r/4 to |0'0')), 
in which case the computation is inconclusive, or the outcome O'l' with probability 
1/2. If the state is in the balanced plane, we will either obtain the outcome 0'0' with 
probability 1/2, in which case the computation is inconclusive, or the outcome l'l' with 
probability 1/2. So in either case, with probability 1/2, we can distinguish whether the 
function is constant or balanced in one run of the algorithm by distinguishing between 
the constant and balanced planes, without evaluating the function at any of its inputs 
(i.e., without determining in the constant case whether / maps to and 1 to 0, or 
whether / maps to 1 and 1 to 1, and similarly in the balanced case). 3 

Now, a Hadamard transformation applied to the final states of both registers al- 
lows the constant and balanced planes to be distinguished (with probability 1/2) by a 

2 Since P\ C1 ) an d P\c 2 ) are orthogonal, P c = P\ C1 ) + P\c 2 ) = P\ci) v P\c 2 )< wnere 'V represents 
quantum disjunction: the infimum or span (the smallest subspace containing the two component subspaces). 
Similarly for P b . 

3 Equivalently, we could measure the output register. If the outcome is 0', the computation is inconclusive. 
If the outcome is 1', we measure the input register. The outcome 1' or 0' then distinguishes whether the 
function is constant or balanced. 
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measurement in the computational basis. Since H 2 = I, so |0'0') 1 00), etc., a 
Hadamard transformation of the state amounts to dropping the primes in the represen- 
tation dl4t . (I15> for the constant and balanced planes. More precisely, the relationship 
between the states |ci), \c 2 ), \b\), 1 62} in 10, ©, (0, l|6} and the constant and bal- 
anced planes defined by P c = fjo'}|o') + -P|o')|i') and A = fjo'}|o') + ^i')|i') is 
the same, after the Hadamard transformation of the state, as the relationship between 
the states |ci), |c2), \bi), \b 2 ) and the planes defined by P c — -P|o)|o) + P\o)\i) an d 
Pb = -P| o> 1 o> + P\ 1) 1 1) • That is> under the Hadamard transformation: 

|d) - J=(| )|0) + |0)|1)) (16) 



V2 V 



|c 2 ) - -4 (|0)|0)-|0)|1)) (17) 



and: 



V2 

So the transformed constant plane HP C is spanned by: 

1 



|d) - -J=(|0)|0) + |1)|1)) (18) 
\b 2 ) - -4 (|0)|0)-|1)|1)) (19) 



(H\ Cl ) + H\ca)) (20) 

|0>|X> = -L(H\cr)-H\c 2 )) (21) 
and the transformed balanced plane HPb is spanned by: 

|0)|0) = ^=(H\h) + H\b 2 )) (22) 

|1)|1) = ^(H\h) - H\b 2 }) (23) 

This is crucial for an evaluation of the efficiency of the algorithm relative to a clas- 
sical algorithm. The number of relevant computational steps in a quantum algorithm 
is conventionally counted as the number of applications of unitary transformations and 
measurements required to yield a solution, where the unitary transformations belong to 
a standard set of elementary unitary gates that form a universal set, and the measure- 
ments are in the computational basis. 

In Cleve's variation, the two registers are initialized to |0) and |1), respectively 
(instead of to |0) and |0)). A Hadamard transformation to both registers yields the 
transition: 

ICID »- (24. 
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Since 

C>)|:c>|tf> = |a;>|y0/(aO> (25) 

it follows that 

10) -II) f l-) M #if/W=o 



^ l-k) M #if/w = l 

which can be expressed as 



WM^I ^ H)«"l^ (TO 

The value of the function now appears as a phase of the final state of the input register. 
For the input state l/>/2(|0) + |1)), we have: 

|0) + |1) |0)-|1) (-i)/(Q)|Q) + (-i)/(i)|i) |Q)-|i) 

" /_ ?5 7T ~ vl VT~ (28) 

which can be expressed as: 

D 10) ± ID 10) -ID f^^WK /(») = /(!) 
' VS \ t MMl = ±|1')|1') if /(0)^/(l) 

Instead of the final state of the two registers ending up as one of two orthogonal 
states in the constant plane, or as one of two orthogonal states in the balanced plane, the 
final state now ends up as ±|0'1') in the constant plane, or as ±|1'1') in the balanced 
plane, and these states can be distinguished because they are orthogonal. So we can 
decide with certainty whether the function is constant or balanced after only one run of 
the algorithm. In fact, we can distinguish these two possibilities by simply measuring 
the input register in the prime basis, and since a final Hadamard transformation on the 
state of the input register takes |0') to |0) and |1') to |1)), we can distinguish the two 
planes by measuring the input register in the computational basis. Note that the state of 
the output register is unchanged: at the end of the process it is in the state 1 1') = H 1 1) 
as in (1241. 

Deutsch's XOR problem can be generalized to the problem ('Deutsch's problem') 
of determining whether a Boolean function / : B " — > B is constant or whether it is bal- 
anced, where it is promised that the function is either constant or balanced. 'Balanced' 
here means that the function takes the values and 1 an equal number of times, i.e., 
2"~ 1 times each. Exploiting the Cleve variation of the XOR algorithm, the Deutsch- 
Jozsa algorithm |4| determines whether / is constant or balanced in one run. 

The algorithm proceeds by setting the input rt-qubit register to the state |0) (an 
abbreviation for the state |0 • • • 0) = |0) • • • |0)) and the output 1-qubit register to the 
state |1), as in the Cleve variation of the XOR algorithm. An n-fold Hadamard trans- 
formation is applied to the input register and a Hadamard transformation to the output 
register, followed by the unitary transformation U / to both registers, and finally an 
n-fold Hadamard transformation to the input register. 
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The state of the input register ends up as: 



EE LJ ^ — Iv> = £ l -£-io...q>+... C3Q) 

y x x 

The amphtude of the state |0 . . . 0) in the linear superposition (I3Q> is J2 X ^"2" — ■ If 
/ is constant, this coefficient is ±1, so the coefficients of the other terms must all be 
0. If / is balanced, f(x) — for half the values of x and f(x) — 1 for the other 
half, so the positive and negative contributions to the coefficient of |0 ... 0) cancel to 
0. In other words, if / is constant, the state of the input register is ±|0 . . . 0); if / is 
balanced, the state is in the orthogonal subspace. Since the initial and final Hadamard 
transformations can be implemented efficiently, i.e., with a number of elementary uni- 
tary gates that is only a polynomial function of the size of the input, the algorithm is 
exponentially faster than any classical algorithm. 

This is the usual way of describing how the algorithm works. To see what is go- 
ing on from a quantum logical perspective, in terms of the subspaces representing the 
constant and balanced quantum propositions, consider, for simplicity, the case n = 2. 
After the transformation U /, but before the final Hadamard transformation, the state of 
the input register is either (constant): 

±i(|00) + |01) + |10> + |ll» (31) 

or (balanced): 

i(±|00)±|01)±|10)±|ll» (32) 

where two of the coefficients are +1 and two of the coefficients are —1. Evidently, there 
are three (distinct, up to an overall phase e l7r = — 1) mutually orthogonal such balanced 
states, and they are all orthogonal to the constant state. So the three balanced states 
lie in a 3-dimensional subspace orthogonal to the constant state and can therefore be 
distinguished from the constant state. The final Hadamard transformation transforms 
the constant state to the state to |00): 

i(|00) + |01) + |10) + |ll))^|00) (33) 

and the three balanced states to states in the 3-dimensional subspace orthogonal to 1 00) . 
So to decide whether the function is constant or balanced we need only measure the 
input register in the computational basis and check whether it is in the state 1 00) . 

The Cleve variation of Deutsch's XOR algorithm and its application to the Deutsch- 
Jozsa algorithm for Deutsch's problem are included here for completeness in illustrat- 
ing the geometric features of these algorithms. The relevant feature of the information- 
processing for comparison with Simon's algorithm and Shor's algorithm is already, and 
more clearly shown, in the original XOR algorithm, as we will see below. 
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3 Simon's Algorithm 



Simon's problem is to find the period r of a periodic Boolean function / : B n — > B n , 
i.e., a function for which 

f(xi) = f(xj) if and only if Xj = ijffl r, for all Xi,Xj £ B n (34) 

Note that since x (B r Q> r = x, the function is 2-to- 1 . 

Since / is periodic, the possible outputs of / — the values of / for the different 
inputs — partition the set of input values into mutually exclusive and collectively ex- 
haustive subsets, and these subsets depend on the period. So, determining the period of 
/ amounts to distinguishing the partition corresponding to the period from alternative 
partitions corresponding to alternative possible periods. 

Simon's algorithm solves the problem efficiently, with an exponential speed-up 
over any classical algorithm (see 1 1 3 14 1). The input and output registers are initialized 
to the state |0)|0) in the computational basis (where, as before, |0) is an abbreviation 
for |0) . . . |0) = |0 . . . 0)) and the state is evolved as follows: 



H 



L E l*>l°> (35) 
|=£|s>l/(*)> (36) 

V X 

1 \ - \xj) + \xj ®r) 

= 7¥^\ mXl)) (3?) 

where Uf is the unitary transformation implementing the Boolean function as: 

U f :\x)\y)^\x)\y®f(x)) (38) 

A measurement of the output register would leave the input register in a state of the 
form: 4 

( } 

This state contains the information r, but summed with an unwanted randomly chosen 
offset X{ that depends on the measurement outcome. A direct measurement of the state 
label would yield any x £ B n equiprobably, providing no information about r. 
The application of a final Hadamard transformation yields: 

\Xi) + \Xi®r) 1 ^ (_l)- 4 -V+(_l)(x,©r>» (4Q) 



V2 v^^„ V2 



E 



ir.r-u- 



^ ^ -\y) (41) 



4 Considering a measurement of the output register here is simply a pedagogical device, for clarity. In- 
stead, we could refer to the reduced state of the input register, which is a mixture of states of the form 1391 . 
No actual measurement of the output register is required, only a measurement of the input register. 
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where the last equality follows because terms interfere destructively if r ■ y = 1 . A mea- 
surement of the input register in the computational basis yields a value y (equiprobably) 
such that r ■ y = 0. Repeating the algorithm sufficiently many times yields enough val- 
ues yi sothatr can be determined by solving the linear equations r-y\ — 0, . . . ,r-yk = 
0. 

To see how the algorithm works quantum logically in terms of the subspaces rep- 
resenting the relevant quantum propositions, consider the case n = 2. There are 
2 2 — 1 = 3 possible values of the period r: 01, 10, 11, and the corresponding par- 
titions are: 

r = 01 : {00, 01}, {10, 11} 
r = 10 : {00, 10}, {01, 11} 
r = 11 : {00, 11}, {01, 10} 

The corresponding states of the input and output registers after the unitary transforma- 
tion Uf are: 

r = 01 : i(|00) + |01»|/(00)> + ±(|10) + |11»|/(10)) 
r = 10 : ±(|00) + |10»|/(00)) + ±(|01) + |11»|/(01)) 
r = 11 : i(|00) + |ll»|/(00)) + ±(|01) + |10»|/(01)) 

Notice that this case reduces to the same construction as in Deutsch's XOR algo- 
rithm. For r = 10 the input register states are: 

|ci) = -L(|00) + |10)) (42) 

|c 2 > = -^=(|01> + |11» (43) 
and for r = 11 the input register states are: 

|&i) = -L(|00) + |11)) (44) 

l&2> = ^=(|01> + |10» (45) 

depending on the outcome of a measurement of the output register. Here the orthogonal 
states |ci), \c2) represent the two subsets of the partition associated with the period r = 
10, the orthogonal states I&2) represent the two subsets of the partition associated 
with the period r = 11, and the orthogonal states |00) + |01),|10) + |11) represent the 
two subsets of the partition associated with the period r = 01. 

The three partitions associated with the three possible periods are represented by 
three planes in TL 2 ® H 2 , which correspond to the constant and balanced planes in 
Deutsch's XOR algorithm, and a third orthogonal plane. While the states representing 
subsets of different partitions associated with different periods are nonorthogonal, the 
three planes (spanned by these states) are mutually orthogonal, except for an intersec- 
tion in the ray spanned by the vector |0'0') in the prime basis (i.e., their projection 
operators commute): 
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r = 01 : plane spanned by |0'0'), |1'0') 



r = 10 : plane spanned by |0'0'), |0'1') (corresponds to 'constant' plane) 

r = 11 : plane spanned by |0'0'), |1'1') (corresponds to 'balanced' plane) 

We cannot identify the period by a measurement that identifies the state of the input 
register as a state representing a particular subset of a particular partition, because the 
states representing subsets of different partitions associated with different periods are 
non-orthogonal. We could identify the plane corresponding to the period by measuring 
the input register in the prime basis, but — as in Deutsch's XOR algorithm — the final 
Hadamard transformation (which, as we have seen, amounts to dropping the primes: 

|0'0') — > 1 00), etc.) allows the plane corresponding to the period to be measured in 
the computational basis. The three possible periods can therefore be distinguished by 
measuring the observable with eigenstates |00), |01), |10), |11), except when the state 
of the register is projected by the measurement onto the state 1 00) (which occurs with 
probability 1/2). So the algorithm will generally have to be repeated until we find an 
outcome that is not 00. 

The n = 2 case of Simon's algorithm essentially reduces to Deutsch's XOR algo- 
rithm. In the n = 3 case (which suffices to exhibit the general feature of the algorithm) 
there are 2 3 - 1 = 7 possible periods: 001, 010, 011, 100, 101, 110, 111. For the 
period r = 001, the state of the two registers after the unitary transformation Uf is: 



±=(|000) + |001»|/(000)) + ^/=(|010> + |011»|/(010)) 

+-U|100) + |101»|/(100)) + -UlllO) + |111))|/(1T0)) (46) 



A measurement of the output register would leave the input register in one of four 
states, depending on the outcome of the measurement: 



Applying a Hadamard transformation amounts to dropping the primes. So if the period 
is r — 001, the state of the input register ends up in the 4-dimensional subspace of 
H 2 ®H 2 ®H 2 spanned by the vectors: |000), |010), |100), |110). 

A similar analysis applies to the other six possible periods. The corresponding 
subspaces are spanned by the following vectors: 



2V2 



2V2 



-L(|ooo) + |ooi» 
-L ( |oio) + |oii» 
-L(|ioo> + |ioi» 

-4(l 110 > + l m » 




r = 001: |000),|010),|100),|110) 
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r = 010: |000),|001),|100),|101) 



r = 011: |000),|011),|100),|111) 



r=100: |000),|001),|010),|011) 



r=101: |000),|010),|101),|111) 



r=110: |000),|001),|110),|111) 



r = 111: 1 000), |011), |101), |110> 



These subspaces are orthogonal except for intersections in 2-dimensional planes. 
The period can be found by measuring in the computational basis. Repetitions of the 
measurement will eventually yield sufficiently many distinct values to determine the 
subspace containing the final state. In this case, it is clear by examining the above list 
that two values distinct from 000 suffice to determine the subspace, and these are just 
the values j/j for which ■ r = 0. 

4 Shor's Algorithm 

Shor's factorization algorithm exploits the fact that the two prime factors p, q of a 
positive integer N = pq can be found by determining the period of a function f(x) = 
a x mod N, for any a < N which is coprime to N, i.e., has no common factors with N 
(other than 1). The period r of f(x) depends on a and N. Once we know the period, 
we can factor N if r is even and a r l 2 ^ —1 mod N, which will be the case with 
probability greater than 1/2 if a is chosen randomly. (If not, we choose another value 
of a.) The factors of N are the greatest common factors of a r l 2 ± 1 and N, which can 
be found in polynomial time by the Euclidean algorithm. (For these number-theoretic 
results, see 1 10 Appendix 4].) So the problem of factorizing a composite integer N that 
is the product of two primes reduces to the problem of finding the period of a certain 
function / : Z s — ► Zn, where Z n is the additive group of integers mod n (rather than 
B n , the n-fold Cartesian product of a Boolean algebra B, as in Simon's algorithm). 

Note that f(x + r) = f(x) if x + r < s. The function / is periodic if r divides s 
exactly, otherwise it is almost periodic. 

Consider first the general form of the algorithm, as it is usually formulated. The 
input register (k qubits, whose states are represented on an s-dimensional Hilbert space 
H s , where s = 2 k ) is initialized to the state |0) G H s and the output register to the state 
|0) G H . A /c-fold Hadamard transformation is applied to the input register, followed 
by the unitary transformation U / which implements the function f(x) = a x mod N: 




(47) 




s-l 



(48) 
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Suppose r divides s exactly. A measurement of the output register in the computa- 
tional basis would leave the input register in a state of the form: 



s/r- 

4f £ 



/r-1 

Xi + jr) (49) 



The value Xi is the offset, which depends on the outcome i of the measurement of the 
output register. The sum is taken over the values of j for which f(xi + jr) = i. Since 
the state label contains the random offset, a direct measurement of the label yields no 
information about the period. 

A discrete quantum Fourier transform for the integers mod s is now applied to the 
input register, i.e., a unitary transformation: 



Unrr. 1 g g2 ^ ly)jfQIxeZs (5Q) 



Note that a Hadamard transformation is a discrete quantum Fourier transform for the 
integers mod 2, so this step is analogous to the application of the Hadamard transfor- 
mation in Simon's algorithm. Under the Fourier transformation, the state of the input 
register undergoes the transition: 



1 ~ 1 r- 1 



J2\x i+ jr) U ^° -^£ e 2 ^|^A) (51) 



=o v fc=0 



where, similar to the derivation of J41> . the amplitudes are non-zero only if y is not 

a multiple k of s/r (i.e., J2j=o e 27rl ^ = s/r if y = ks/r; Ylj=o e 27 ™ 1 ^ = if 
y ks/r). The effect is to shift the offset into a phase factor and invert the period as 
a multiple of s jr. A measurement of the input register in the computational basis then 
yields c = ks/r. The algorithm is run a number of times until a value of k coprime to 
r is obtained. Cancelling c/s to lowest terms then yields k and r as kjr. 

Suppose r does not divide s exactly. Then some of the states in J49I will have an 
additional term. For example, suppose s = r + d, where d < r. Then d of the states in 
( I49> will have an extra term and take the form: 

»/ 



l—J2\ Xi +jr) (52) 

' 3=0 



After the Fourier transformation, the expression ( 15 1> will contain additional terms with 
negligible amplitudes for values of s ^ k (k = 0, 1, . . . , r — 1) if s/r is large. 

Since the value of r is unknown in advance of applying the algorithm, we do not, 
of course, recognize when a measurement outcome yields a value of k coprime to r. 
The idea is to run the algorithm, cancel c/ s to lowest terms to obtain a candidate value 
for r and hence a candidate factor of N, which can then be tested by division into N. 
Even when we do obtain a value of k coprime to r, some values of a will yield a period 
for which the method fails to yield a factor of N, in which case we randomly choose a 
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new value of a and run the algorithm with this value. The point is that all these steps 
are efficient, i.e., can be performed in polynomial time, and since only a polynomial 
number of repetitions are required to determine a factor with any given probability 
p < 1, the algorithm is a polynomial-time algorithm, achieving an exponential speed- 
up over any known classical algorithm. 

To see how the algorithm works from a quantum logical perspective, consider the 
case N = 15, a = 7 and s = 64 discussed in [2 p. 160]. In this case, the function 
f(x) = a x mod 15 is: 



7° 


mod 15 = 


1 


7 1 


mod 15 = 


7 


7 2 


mod 15 = 


4 


7 3 


mod 15 = 


13 


7 4 


mod 15 = 


1 



7 63 mod 15 = 13 

and the period is evidently r = 4, which divides s = 64 exactly. 5 After the application 
of the unitary transformation Uf = a x mod N, the state of the two registers is: 

|(|0)|1) + |1)|7) + |2)|4) + |3)|13) 
+ |4)|1) + |5)|7) + |6)|4) + |7)|13) 

+ |60)|1) + |61)|7) + |62)|4) + |63)|13» (53) 

This is the state (I48> for s = 64, a = 7. This state can be expressed as: 

i(|0) + |4) + |8) + ... + |60))|l) 
+l(|l> + |5> + |9) + ... + |61))|7) 
+ i(|2) + |6) + |10> + ... + |62))|4) 

+!(|3> + |7> + |ll> + ... + |63»|13» (54) 

A measurement of the output register would yield (equiprobably) one of four states 
for the input register, depending on the outcome of the measurement: 1, 7, 4, or 13: 

i(|0) + |4> + |8) + ... + |60» (55) 

i(|l) + |5) + |9) + ... + |61)) (56) 

±(|2) + |6) + |10} + ... + |62)) (57) 

i(|3) + |7) + |ll) + ... + |63)) (58) 

These are the states i49t for values of the offset X\ — ^,x^ — 1, X4 — 2, X13 = 3. 
Application of the quantum Fourier transform yields: 

5 The factors 3 and 5 of 15 are derived as the greatest common factors of a r / 2 — 1 = 48 and 15, and 
a r / 2 + 1 = 50 and 15, respectively. 
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x 1= 0: i(|0) + |16) + |32) + |48)) 
i 7 = l : |(|0> +<|16) - |32)-t|48» 

x 4 = 2 : |(10) - |16) + |32) - |48)) 

x 13 = 3: £(|0)-*|16)-|32)+t|48)) 

which are the states in OTt . (Here s — 64, r = 4; = 4, £ - 1 = 15.) So 
for the period r = 4, the state of the input register ends up in the 4-dimensional sub- 
space spanned by the vectors |0), |16), |32), |48) making the corresponding quantum 
proposition true. 

Note that if, say, s = 66, so that the period r = 4 does not divide s exactly, the 
input states relative to the output states |1) and |7) would each have an additional term, 
so the states (1551 . (I56t would each have an additional term, 1 64) and 1 65), respectively. 
After the quantum Fourier transformation, the states for x\ — and x-j = 1 would be a 
linear superposition of all the states |1), . . . , 1 66) , with small amplitudes for the states 
\i), 0,16, 32, 48. 

Now consider all possible even periods r for which f(x) — a x mod 15, where 
a is coprime to 15. The other possible values of a are 2, 4, 8, 11, 13, 14 and the 
corresponding periods turn out to be 4, 2, 4, 2, 4, 2. So we need only consider r = 2. 6 
Note that different values of a with the same period affect only the labels of the output 
register (e.g., for a = 2, the labels are |1), |2), |4), |8) instead of |1), |7), |4>, 1 13)). So 
different a values for the same period are irrelevant to the quantum algorithm. 

For r = 2, if we measured the output register, we would obtain (equiprobably) one 
of two states for the input register, depending on the outcome of the measurement: 

|0) + |2) + |4) + . . . + |62) (59) 
|l) + |3) + |5) + ... + |63) (60) 

After the quantum Fourier transformation, these states are transformed to: 

x a = 0: |0) + |32) 
x b = l: |0) - |32) 

In this case, the 2-dimensional subspace V r =2 spanned by |0), 1 32) for r = 2 is in- 
cluded in the 4-dimensional subspace V r= 4 for r = 4. A measurement can distinguish 
r = 4 from r = 2 reliably, i.e., whether the final state of the input register is in V r= 4 
or V r= 2, only if the final state is in V r= 4 — V r= 2, the part of V r= 4 orthogonal to V r= 2- 
What happens if the final state ends up in V r= 2? 

Shor's algorithm works as a randomized algorithm. As mentioned above, it pro- 
duces a candidate value for the period r and hence a candidate factor of N, which can 
be tested (in polynomial time) by division into JV". A measurement of the input regis- 
ter in the computational basis yields an outcome c = ks jr. The value of k is chosen 
equiprobably by the measurement of the output register. The procedure is to repeat the 

6 Every value of a except a = 14 yields the correct factors for 15. For a = 14, the method fails: r = 2, 
so a 1 = —1 mod 15. 
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algorithm until the outcome yields a value of k coprime to r, in which case canceling 
c/s to lowest terms yields k and r as k/r. 

For example, suppose we choose a = 7, in which case (unknown to us) r = 4. The 
values of k coprime to r are k = 1 and k = 3 (this is also unknown to us, because 
k depends on the value of r). Then c/s cancelled to lowest terms is 1/4 and 3/4, 
respectively, both of which yield the correct period. From the geometrical perspective, 
these values of k correspond to finding the state after measurement in the computational 
basis to be 1 16} or |48), both of which do distinguish V r= 4 from V r= 2- 

Suppose we choose a value of a with period r = 2 and find the value c = 32. The 
only value of k coprime to r is k = 1. Then c/s cancelled to lowest terms is 1/2, which 
yields the correct period, and hence the correct factors of N. But c = 32 could also be 
obtained for a = 7, r = 4, and k = 2, which does not yield the correct period, and 
hence does not yield the correct factors of N. Putting it geometrically: the value k = 1 
for r — 2 corresponds to the same state, |32), as the value k = 2 for r = 4. Once we 
obtain the candidate period r = 2 (by cancelling c/s = 32/64 to lowest terms), we 
calculate the factors of N as the greatest common factors of a ± 1 and N and test these 
by division into N. If a = 7, these calculated factors will be incorrect. If a = 2, say, 
the factors calculated in this way will be correct. 

5 Conclusion 

Simon's algorithm and Shor's algorithm work as period-finding algorithms by encod- 
ing alternative partitions of the domain of a function, defined by alternative possible 
periods, as quantum propositions represented by subspaces in a Hilbert space, which 
are orthogonal except for overlaps. The subspace corresponding to a particular parti- 
tion is spanned by orthogonal linear superpositions of states associated with the ele- 
ments in the (mutually exclusive and collectively exhaustive) subsets of the partition. 
The period-finding algorithm is designed to produce an entangled state in which such 
superpositions, representing states of an input register, are correlated with distinct or- 
thogonal states of an output register. The reduced state of the input register is then 
an equal-weight mixture of states spanning the subspace corresponding to the parti- 
tion, where each state encodes a subset in the partition as a linear superposition of 
the elements in the subset. Since the subspaces are represented by commuting projec- 
tion operators, a measurement of the state of the input register in a certain basis can 
reveal the subspace containing the state, and hence the period associated with the par- 
tition, except when the measurement projects the state onto the overlap region. This 
measurement basis is unitarily related to the computational basis by a known unitary 
transformation that can be implemented efficiently, so a measurement in the compu- 
tational basis after this unitary information will yield the same information. This is 
the function of the final Hadamard transformation or discrete quantum Fourier trans- 
formation, and the possibility of an efficient implementation of this transformation is 
crucial to the efficiency of the algorithm. By contrast with the classical 'fast Fourier 
transform,' it is a remarkable feature of the discrete quantum Fourier transform that it 
can be implemented efficiently. 

The information-processing in Deutsch's XOR algorithm has a similar quantum 
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logical interpretation in terms of the subspace structure of Hilbert space. The problem 
here is to distinguish two alternative disjunctive properties of a function (0 — » and 
1 — > or — > 1 and 1 — > 1 for a constant function, versus 0-^0 and 1 — > 1 or 
— ► 1 and 1 — > for a balanced function), which are encoded as two planes in a 
4-dimensional Hilbert space (orthogonal except for an overlap). Each disjunct in the 
disjunction is a conjunction of two elements (e.g., 0-^0 and 1 — > 0). The plane 
corresponding to a particular disjunction is spanned by a pair of states that encode the 
elements of the conjunctions as linear superpositions. The algorithm is designed to 
produce one of these states, depending on which disjunction is true of the function. 
From this perspective, the XOR algorithm appears directly as a special case of Simon's 
algorithm. 

The first stage of a quantum algorithm designed to evaluate some global property 
of a function involves the creation of an entangled state of the input and output registers 
in which every value in the domain of the function is correlated with a corresponding 
value in its range. This is referred to as 'quantum parallelism' and is often cited as the 
source of the speed-up in a quantum computation. The idea is that a quantum com- 
putation is something like a massively parallel classical computation, for all possible 
values of a function. This appears to be Deutsch's view in an Everettian many- 
worlds interpretation of quantum mechanics, the parallel computations can be regarded 
as taking place in parallel universes. (For a critique, see 1151 .) 

From the quantum logical perspective outlined here, the picture is entirely differ- 
ent. Rather than 'computing all values of a function at once,' a quantum algorithm 
achieves an exponential speed-up over a classical algorithm precisely by avoiding the 
computation of any values of the function at all. This is redundant information for a 
quantum algorithm but essential information for a classical algorithm. The trick in a 
quantum algorithm is to exploit the non-Boolean logic represented by the projective 
geometry of Hilbert space to encode a global property of a function (such as a period, 
or a disjunctive property) as a subspace in Hilbert space, which can be efficiently dis- 
tinguished from alternative subspaces corresponding to alternative global properties by 
a measurement that determines the target subspace as the subspace containing the final 
state produced by the algorithm. The point of the procedure is precisely to avoid the 
evaluation of the function in the determination of the global property, in the sense of 
producing a value in the range of the function for a value in its domain, and it is this 
feature — impossible in the Boolean logic of classical computation — that leads to the 
speed-up relative to classical algorithms. 
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